Verification method, verification device and carrying tool

Abstract

The invention provides a verification method, a verification device and a delivery vehicle, the method can be applied to the field of vehicles, and the method comprises the following steps: obtaining a first event; first request information sent by the second module is received, the first request information is used for requesting to verify the legality of a first control instruction, and the first control instruction is associated with the first input; determining that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment being associated with the moment when the first event occurs, and the second moment being associated with the moment when the first request information is received; and sending first response information to the second module, wherein the first response information is used for indicating that the validity verification of the first control instruction is passed. Through the method, the legality of the first control instruction can be verified based on the occurrence moment of the first event and the receiving moment of the first request information, so that an illegal vehicle control instruction is prevented from being sent to a corresponding module or part to be executed.

Description

Technical Field

[0001] The present application relates to the field of vehicles, and, more specifically, to a verification method, a verification device and a vehicle. Background Art

[0002] As smart cars are widely used in daily life, users expect smart cars to bring a more comfortable user experience. Smart cars allow users to issue vehicle control instructions through human-computer interaction. The vehicle control instructions may include vehicle body control instructions, such as control instructions for doors, windows, air conditioners and seats, or the vehicle control instructions may include control instructions for switches in the power domain. The deployment of the vehicle's human-computer interaction system was originally intended to enrich the entertainment experience of drivers and passengers, which led to the deployment of the human-computer interaction system in the vehicle's entertainment domain system.

[0003] However, the vehicle's entertainment domain system has a lot of third-party applications and networking services, so there is a risk of being hacked by attackers. Therefore, when the vehicle's entertainment domain system is hacked or even broken by attackers, how to ensure the security of vehicle control commands is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a verification method, a verification device and a vehicle, which can prevent illegal control instructions from being sent to corresponding modules or components for execution when the entertainment domain system of the vehicle is invaded or even broken by an attacker, thereby improving the system security of the vehicle.

[0005] In a first aspect, a verification method is provided, which is applied to a first module, and the method includes: obtaining a first event; receiving a first request message sent by a second module, the first request message is used to request verification of the legality of a first control instruction, and the first control instruction is associated with a first input; determining that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment is associated with a moment when the first event occurs, and the second moment is associated with a moment when the first request message is received; sending a first response message to the second module, the first response message is used to indicate that the legality verification of the first control instruction has passed.

[0006] Optionally, the first module may be a trusted module or a verification module, and the verification module may include: a vehicle control scene verification module.

[0007] Optionally, the first event may be a human-computer interaction event. When the first module is a trusted module, the first module may directly obtain the first event. When the first module is a verification module, the first module may obtain the first event from other modules (eg, trusted modules).

[0008] Optionally, the first control instruction may be a vehicle control instruction, which may include: a vehicle body control instruction, for example, a control instruction for a door, a window, an air conditioner and a seat, or the control instruction may include a control instruction for a switch in a power domain.

[0009] Optionally, the second moment may be the moment when the first module receives the first request information, the second moment may also be understood as the moment when the second module sends the first request information, or the second moment may also be understood as the moment when the first control instruction is generated.

[0010] In a possible implementation manner, obtaining the first event may further include: obtaining the first event and the first moment.

[0011] In a possible implementation, when the first module determines that the duration between the first moment and the second moment is greater than a first preset duration, a second response message may be sent to the second module, where the second response message is used to indicate that the legitimacy verification of the first control instruction has failed.

[0012] In an embodiment of the present application, the legitimacy of the first control instruction can be verified based on the time of occurrence of the first event and the time of receipt of the first request information, thereby preventing illegal control instructions from being sent to the corresponding module or component for execution, and improving the system safety of the vehicle.

[0013] In combination with the first aspect, in some implementations of the first aspect, before determining that the duration between the first moment and the second moment is less than or equal to a first preset duration, the method further includes: verifying that the first request information is associated with the first event.

[0014] Optionally, detecting that the first request information is associated with the first event may be understood as detecting that the first request information is generated based on the first event.

[0015] In an embodiment of the present application, when it is detected that the first request information is associated with the first event, the first module verifies the legitimacy of the first control instruction based on the time of occurrence of the first event and the time of receipt of the first request information. In this way, it can further prevent illegal control instructions from being sent to the corresponding module or component for execution, thereby better ensuring the safe operation of the components in the vehicle.

[0016] In combination with the first aspect, in some implementations of the first aspect, the first response information includes a signature result, and the signature result includes a signature for the first moment.

[0017] Optionally, the first module may sign the first moment to obtain a signature result, and carry the signature result in the first response information.

[0018] Optionally, the signature result may include a signature for the first event.

[0019] In an embodiment of the present application, the first module can send a first response message to the second module, and the first response message carries a signature for the first moment. The second module can send the signature result to the module and component that executes the control instruction, so that the module or component that executes the control instruction can determine whether to execute the first control instruction based on the signature result. In this way, it can further avoid the illegal first control instruction from being executed by the corresponding module or component, preventing the attacker from causing more serious consequences after invading the vehicle.

[0020] In combination with the first aspect, in some implementations of the first aspect, the first event includes: input of a physical key, input of a touch screen, or input of voice interaction.

[0021] In combination with the first aspect, in certain implementations of the first aspect, the first event includes the input of the voice interaction, and obtaining the first event includes: detecting a preset keyword, and the preset keyword includes: a wake-up word or a preset control instruction; and obtaining the first event according to the preset keyword.

[0022] Optionally, the wake-up word may be a keyword including the name of the voice assistant.

[0023] In an embodiment of the present application, when the first module detects that the user has the intention to interact with the voice assistant, the first module obtains the first event and verifies the legitimacy of the first control instruction based on the time corresponding to the first event. In this way, on the one hand, it can further prevent illegal control instructions from being sent to the corresponding module or component for execution. On the other hand, when the first module does not detect that the user has the intention to interact with the voice assistant, the voice assistant can be put into hibernation to reduce the risk of the user's voice interaction being stolen by attackers.

[0024] In combination with the first aspect, in certain implementations of the first aspect, before detecting the preset keyword, the method also includes: detecting whether the voice interaction includes the preset keyword based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

[0025] In a second aspect, a verification method is provided, which is applied to a second module, and the method includes: generating a first control instruction, wherein the first control instruction is associated with a first input; if a first event exists within a first preset time period, sending the first control instruction to a third module, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0026] Optionally, the second module may be an instruction generation module, and the instruction generation module may include: a vehicle control hardware abstraction layer (HAL) and / or a vehicle control service module.

[0027] Optionally, the first control instruction being associated with the first input may be understood as the first control instruction being generated based on the first input, and the first input may be related to the first event, or the first input may be an attacker's input.

[0028] Optionally, the second moment being associated with the first control instruction may be understood as the second moment being the moment when the first control instruction is generated.

[0029] In the embodiment of the present application, after the second module generates the first control instruction, if the first event occurs within the first preset time period, the second module can send the first control instruction to the third module so that the third module executes the first control instruction. In this way, it is possible to prevent illegal control instructions from being sent to the third module for execution, thereby improving the system safety of the vehicle.

[0030] In combination with the second aspect, in certain implementations of the second aspect, before sending the first control instruction to the third module, the method also includes: sending a first request message to the first module, the first request message being used to request verification of the legality of the first control instruction; receiving a first response message sent by the first module, the first response message being used to indicate that the legality verification of the first control instruction has passed, and the passing of the legality verification of the first control instruction is included within the first preset time length, and the first event exists.

[0031] Optionally, after the second module receives the second response information sent by the first module, the second module may not send the first control instruction to the third module, and the second response information is used to indicate that the legitimacy verification of the first control instruction fails.

[0032] In an embodiment of the present application, the second module may request the first module to verify the legality of the first control instruction, and if the first control instruction is legal, send the first control instruction to the third module. In this way, the module that verifies the first control instruction and the module that sends the first control instruction are separated, which can ensure that each module focuses on its own task, help to more effectively manage and control control instructions, and prevent illegal control instructions from being sent to the third module for execution.

[0033] In combination with the second aspect, in some implementations of the second aspect, before sending the first control instruction to the third module, the method further includes: querying whether the first event exists within the first preset time length.

[0034] Optionally, when the second module inquires that the first event exists within the first preset time period, the second module may send the first control instruction to the third module; otherwise, the second module may not send the first control instruction to the third module.

[0035] In the embodiment of the present application, the second module can query whether the first control instruction is legal by itself, so that illegal control instructions can be prevented from being sent to the corresponding third module for execution.

[0036] In combination with the second aspect, in some implementations of the second aspect, the method further includes: sending a signature result to the third module, wherein the signature result includes a signature for the first moment.

[0037] Optionally, the signature result also includes a signature for the first event.

[0038] In an embodiment of the present application, the second module can send a signature result to the third module, and the signature result includes a signature of the first moment, so that the third module can determine whether to execute the first control instruction based on the signature result. In this way, it can further avoid the illegal first control instruction from being executed by the third module, preventing the attacker from causing more serious consequences after invading the vehicle.

[0039] In combination with the second aspect, in some implementations of the second aspect, before sending the signature result to the third module, the method further includes: receiving the signature result sent by the first module.

[0040] Optionally, the first module may send a first response message to the second module, wherein the first response message includes the signature result.

[0041] According to a third aspect, a verification method is provided, which is applied to a third module, and includes: receiving a first control instruction sent by a second module; if a first event exists within a first preset time period, executing the first control instruction, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0042] Optionally, the third module may be located in a vehicle domain controller (VDC).

[0043] In the embodiment of the present application, after receiving the first control instruction, the third module executes the first control instruction if the first event occurs within the first preset time period. In this way, the third module can be prevented from executing illegal control instructions, thereby ensuring the system safety of the vehicle.

[0044] In combination with the third aspect, in certain implementations of the third aspect, before executing the first control instruction, the method also includes: receiving a signature result sent by the second module, the signature result including a signature for the first moment; determining that the duration between the first moment and the third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

[0045] Optionally, after receiving the signature result, the third module may use the key to decrypt the signature result to obtain the first moment.

[0046] Optionally, when the duration between the first moment and the third moment is greater than a second preset duration, the third module may not execute the first control instruction.

[0047] In an embodiment of the present application, the third module can determine whether to execute the first control instruction based on the first moment included in the signature result and the third moment when the first control instruction is received. In this way, the third module can be further prevented from executing illegal control instructions, thereby causing unnecessary losses to the user.

[0048] In combination with the third aspect, in some implementations of the third aspect, the first event includes: input of a physical key, input of a touch screen, or input of voice interaction.

[0049] In a fourth aspect, a verification device is provided, which includes: an acquisition unit, used to acquire a first event; a transceiver unit, used to receive a first request message sent by a second module, the first request message is used to request verification of the legality of a first control instruction, and the first control instruction is associated with a first input; a processing unit, used to determine that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment is associated with a moment when the first event occurs, and the second moment is associated with a moment when the first request message is received; the transceiver unit is also used to send a first response message to the second module, and the first response message is used to indicate that the legality verification of the first control instruction has passed.

[0050] In combination with the fourth aspect, in some implementations of the fourth aspect, the processing unit is further used to verify that the first request information is associated with the first event.

[0051] In combination with the fourth aspect, in certain implementations of the fourth aspect, the first response information includes a signature result, and the signature result includes a signature for the first moment.

[0052] In combination with the fourth aspect, in some implementations of the fourth aspect, the first event includes: input of a physical key, input of a touch screen, or input of voice interaction.

[0053] In combination with the fourth aspect, in certain implementations of the fourth aspect, the acquisition unit is specifically used to: detect a preset keyword, where the preset keyword includes: a wake-up word or a preset control instruction; and acquire the first event according to the preset keyword.

[0054] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is further used to detect whether the voice interaction includes the preset keywords based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

[0055] In the fifth aspect, a verification device is provided, characterized in that the device includes: a processing unit, used to generate a first control instruction, the first control instruction is associated with a first input; a transceiver unit, used to send the first control instruction to a third module if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0056] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is also used to: send a first request message to the first module, the first request message is used to request verification of the legality of the first control instruction; receive a first response message sent by the first module, the first response message is used to indicate that the legality verification of the first control instruction has passed, and the legality verification of the first control instruction has passed is included within the first preset time length, and the first event exists.

[0057] In combination with the fifth aspect, in some implementations of the fifth aspect, the processing unit is further used to query whether the first event exists within the first preset time period.

[0058] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to send a signature result to the third module, where the signature result includes a signature at a first moment, and the first moment is associated with a moment when the first event occurs.

[0059] In combination with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further used to receive the signature result sent by the first module.

[0060] In the sixth aspect, a verification device is provided, which includes: a transceiver unit for receiving a first control instruction sent by a second module; a processing unit for executing the first control instruction if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0061] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to receive a signature result sent by the second module, the signature result including a signature of a first moment, and the first moment is associated with a moment when the first event occurs; the processing unit is further used to determine that the duration between the first moment and a third moment is less than or equal to a second preset duration, wherein the third moment is associated with a moment when the first control instruction is received.

[0062] In combination with the sixth aspect, in certain implementations of the sixth aspect, the first event includes: input from a physical key, input from a touch screen, or input from voice interaction.

[0063] In the seventh aspect, a verification device is provided, comprising: at least one processor and a memory, wherein the at least one processor is coupled to the memory and is used to read and execute instructions in the memory, so that the device implements the method in any one of the implementation methods of the first to third aspects above.

[0064] In an eighth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a program code, and when the computer program code runs on a computer, the computer executes a method in any one of the implementation modes of the first to third aspects above.

[0065] In a ninth aspect, a chip is provided, the chip comprising a circuit, the circuit being used to execute the method in any one of the implementations of the first to third aspects above.

[0066] In a tenth aspect, a computer program product is provided, which includes a computer program. When the computer program is executed, the computer executes the method in any one of the implementation modes of the first to third aspects above.

[0067] In the eleventh aspect, a vehicle is provided, comprising: a device in any one of the implementations of the fourth or sixth aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 is a functional schematic diagram of a vehicle provided in an embodiment of the present application;

[0069] Figure 2 is a schematic flow chart of automatic parking provided by an embodiment of the present application;

[0070] Figure 3 It is a system architecture applicable to the verification method provided in the embodiment of the present application;

[0071] Figure 4 is a schematic flow chart of a verification method provided in an embodiment of the present application;

[0072] Figure 5 It is another system architecture applicable to the verification method provided in the embodiment of the present application;

[0073] Figure 6 is a schematic flow chart of another verification method provided in an embodiment of the present application;

[0074] Figure 7 It is another system architecture applicable to the verification method provided in the embodiment of the present application;

[0075] Figure 8 is a schematic flow chart of another verification method provided in an embodiment of the present application;

[0076] Fig. 9 is a schematic flow chart of intelligent cockpit voice processing provided by an embodiment of the present application;

[0077] Fig.10 This is the scenario to which the verification method provided in the embodiment of the present application is applicable;

[0078] Fig.11 It is a verification device provided in an embodiment of the present application;

[0079] Fig.12 This is another verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0081] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In the present application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0082] The prefixes such as "first" and "second" used in the embodiments of the present application are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers used to distinguish description objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0083] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0084] Figure 1 It is a functional schematic diagram of the vehicle 100 provided in an embodiment of the present application.

[0085] The vehicle 100 may include a variety of subsystems, such as a sensing system 120, a computing platform 130, and a key management system 140. Optionally, the vehicle 100 may include more or fewer subsystems, and each subsystem may include one or more components. In addition, each subsystem and component of the vehicle 100 may be interconnected by wire or wirelessly.

[0086] The perception system 120 may include several sensors for sensing information about the environment around the vehicle 100. For example, the perception system 120 may include a positioning system, which may be a global positioning system (GPS), a Beidou system, or other positioning systems. The perception system 120 may include one or more of an inertial measurement unit (IMU), a laser radar, a millimeter wave radar, an ultrasonic radar, and a camera.

[0087] Some or all functions of the vehicle 100 may be controlled by a computing platform 130. The computing platform 130 may include processors 131 to 13n (n is a positive integer). The processor is a circuit with signal processing capability. In one implementation, the processor may be a circuit with instruction reading and execution capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which may be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor may implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the hardware circuit may be fixed or reconfigurable, such as a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration may be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, the processor may also be a hardware circuit designed for artificial intelligence, which may be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc. In addition, the computing platform 130 may also include a memory, the memory is used to store instructions, and some or all of the processors 131 to 13n may call the instructions in the memory to implement corresponding functions.

[0088] Computing platform 130 may control functions of vehicle 100 based on input received from various subsystems (eg, perception system 120). In some embodiments, computing platform 130 may be used to provide control over many aspects of vehicle 100 and its subsystems.

[0089] The entertainment system 140 can provide entertainment functions and human-computer interaction functions, and provide the driver and passengers with a comfortable, pleasant and interactive riding experience, thereby enhancing the functionality and intelligence level of the vehicle. Optionally, the entertainment system 140 can also be located in the computing platform 130.

[0090] Optionally, the above components are just an example, and in actual applications, the components in the above modules may be added or deleted according to actual needs.

[0091] The vehicle 100 in the present application may include: road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the vehicle 100 may be a vehicle, which is a vehicle in a broad sense, and may be a vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a lawn mower, a harvester, etc.), amusement equipment, a toy vehicle, etc. The embodiment of the present application does not specifically limit the type of vehicle. For another example, the vehicle 100 may be a vehicle such as an airplane or a ship.

[0092] The following takes the vehicle 100 as an example to illustrate the technical problems to be solved by the present application and the technical solutions adopted.

[0093] As smart cars are widely used in daily life, users expect smart cars to bring a more comfortable user experience. Smart cars allow users to issue vehicle control instructions through human-computer interaction. The vehicle control instructions may include vehicle body control instructions, such as control instructions for doors, windows, air conditioners and seats, or the vehicle control instructions include control instructions for switches in the power domain. The deployment of the vehicle's human-computer interaction system was originally intended to enrich the entertainment experience of drivers and passengers, which led to the deployment of the human-computer interaction system in the vehicle's entertainment domain system.

[0094] For example, Figure 2 In the automatic parking service shown in the figure, the user can initiate an automatic parking request through the human-machine interface (HMI) in the cockpit, and the vehicle will plan a route and feedback the route plan to the user; after the user selects the route, the vehicle can start automatic parking. During this process, the user can interact with the vehicle through the touch screen or voice.

[0095] However, the deployment of the vehicle's human-machine interaction system was originally intended to enrich the entertainment experience of drivers and passengers, which led to the deployment of the human-machine interaction system in the vehicle's entertainment domain system. However, the vehicle's entertainment domain system has a wealth of third-party applications and networking services, so there is a risk of being invaded by attackers. Therefore, when the vehicle's entertainment domain system is invaded or even broken by attackers, how to ensure the security of vehicle control commands is an urgent problem to be solved.

[0096] The embodiments of the present application provide a verification method, a verification device, and a vehicle, which can prevent illegal control instructions from being sent to corresponding modules or components for execution when the entertainment domain system of the vehicle is invaded or even breached by an attacker, thereby improving the system security of the vehicle.

[0097] Figure 3 This is the system architecture applicable to the verification method provided in the embodiment of the present application. This system architecture can be applied to Figure 1 In the vehicle 100.

[0098] like Figure 3 As shown, the architecture includes: entertainment domain, management domain and instrument domain.

[0099] In the entertainment domain, users can initiate vehicle control requests through physical buttons, touch screens or voice assistants. After being processed by the entertainment domain, the vehicle control request can be converted into a vehicle control command. The vehicle control command reaches the corresponding VDC or multi domain controller (MDC) through the vehicle interface unit (VIU); after the VDC or MDC receives the vehicle control command for verification, it can send the vehicle control command to the corresponding electronic control unit (ECU) for execution. Among them, the vehicle control command may include control commands for the vehicle body, such as opening doors and windows, or the vehicle control command may include control commands for the power domain, such as automatic parking, cruise assist and other commands.

[0100] In the instrument domain, it can include instrument panel cluster (IPC) and head-up display (HUD). The vehicle can provide key vehicle information to the driver through IPC and HUD, including speed, speed, mileage, fuel status, warning lights, audio control, etc. The functions of IPC and HUD are designed to help the driver understand and control the status of the vehicle to improve driving safety and convenience.

[0101] In the management domain, on-board diagnostics (OBD) and over the air (OTA) can be included, which can provide vehicle diagnosis, remote maintenance, software updates, security management and data analysis. OBD and OTA can provide more convenient, efficient and safe vehicle management and maintenance methods for automakers, maintenance service providers and car owners.

[0102] Figure 4 It is a schematic flow chart of a verification method provided in an embodiment of the present application. The method 400 can be applied to the architecture 300. The method 400 can include: steps S401 to S405.

[0103] S401, the second module generates a first control instruction.

[0104] Exemplarily, the second module may be an instruction generation module, which may include: a vehicle control hardware abstraction layer and / or a vehicle control service module; the first control instruction may be associated with the first input.

[0105] Optionally, the first control instruction may be a vehicle control instruction, which may include: a vehicle body control instruction, for example, a control instruction for a door, a window, an air conditioner and a seat, or the control instruction may include a control instruction for a switch in a power domain.

[0106] S402: The second module sends first request information to the first module.

[0107] Among them, the first request information is used to request verification of the legitimacy of the first control instruction; the first module may be a trusted module or a verification module, and the verification module may include: a vehicle control scene verification module.

[0108] In one embodiment, before step S402, the first module may obtain the first event, or obtain the first event and the first moment, so that the first module determines the legitimacy of the first control instruction based on the first moment, wherein the first moment is associated with the moment when the first event occurs.

[0109] Optionally, the first event may be a human-computer interaction event. When the first module is a trusted module, the first module may directly obtain the first event. When the first module is a verification module, the first module may obtain the first event from other modules (eg, trusted modules).

[0110] Optionally, the first event may include: input of a physical key, input of a touch screen, or input of voice interaction.

[0111] In one embodiment, when the first event includes the input of voice interaction, the first module can detect whether the input of voice interaction includes preset keywords before obtaining the first event. In the case where the input of voice interaction includes preset keywords, the first module can obtain the first event. In this way, on the one hand, it can further prevent illegal control instructions from being sent to the third module for execution. On the other hand, when the first module detects that the user has the intention to interact with the voice assistant, the voice assistant can be put into sleep mode, thereby reducing the risk of the user's voice interaction being stolen by an attacker.

[0112] Optionally, the above-mentioned preset keywords include wake-up words or preset control instructions.

[0113] Optionally, the wake-up word may be a keyword including the name of the voice assistant.

[0114] In one embodiment, a digital signal processor DSP or a high-fidelity Hi-Fi chip may be used to detect whether the voice interaction includes preset keywords.

[0115] S403: The first module determines that the duration between the first moment and the second moment is less than or equal to a first preset duration.

[0116] Among them, the first preset duration can be associated with the first moment and the second moment, wherein the first moment can be associated with the first event, for example, the first moment is the moment when the first event occurs; the second moment can be the moment when the first module receives the first request information, and the second moment can also be understood as the moment when the second module sends the first request information, or the second moment can also be understood as the moment when the first control instruction is generated.

[0117] Optionally, the first preset duration can be set to 1 second.

[0118] In one embodiment, before step S403, the first module may verify that the first request information is associated with the first event. In this way, illegal control instructions can be further prevented from being sent to corresponding modules or components for execution, thereby better ensuring the safe operation of components in the vehicle.

[0119] In one embodiment, the second module may also locally query the legitimacy of the first control instruction to determine whether to send the first control instruction to the third module. Specifically, the second module may not execute step S402, and replace step S403 with: the second module determines that the duration between the first moment and the second moment is less than or equal to the first preset duration.

[0120] S404: The first module sends first response information to the second module.

[0121] The first response information is used to indicate that the legitimacy verification of the first control instruction has passed.

[0122] In one embodiment, the first response information includes a signature result, and the signature result includes a signature for the first moment. The signature result can facilitate the third component to determine whether to execute the first control instruction according to the signature result, so that the illegal first control instruction can be further prevented from being executed by the corresponding module or component, preventing the attacker from causing more serious consequences after invading the vehicle.

[0123] Optionally, the first module may sign the first moment to obtain a signature result, and carry the signature result in the first response information.

[0124] Optionally, the signature result also includes a signature for the first event.

[0125] In one embodiment, when step S403 is replaced by the first module determining that the duration between the first moment and the second moment is greater than the first preset duration, then in step S404, the first module may send a second response message to the second module, and the second response message is used to indicate that the legitimacy verification of the first control instruction fails, then the second module may not execute step S405.

[0126] S405: The second module sends a first control instruction to the third module.

[0127] Among them, the third module can be located in the VDC of the vehicle.

[0128] In an embodiment of the present application, the first module can verify the legitimacy of the first control instruction based on the occurrence time of the first event and the reception time of the first request information, thereby preventing illegal control instructions from being sent to the corresponding module or component for execution, and improving the system safety of the vehicle.

[0129] The third module may perform different processing after receiving the first control instruction.

[0130] In one embodiment, if the first event occurs within a first preset time period, the third module may execute the first control instruction.

[0131] In one embodiment, after the third module receives the signature result sent by the second module, the signature result can be decrypted using the key to obtain the first moment. After determining that the duration between the first moment and the third moment is less than or equal to the second preset duration, the third module can execute the first control instruction, otherwise, the third module does not execute the first control instruction. The third moment is associated with the moment when the third module receives the first control instruction. In this way, the use of the signature result can further prevent the third module from executing illegal control instructions, thereby causing unnecessary losses to the user.

[0132] It should be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0133] Figure 5 It is another system architecture applicable to the verification method provided in the embodiment of the present application. The system architecture 500 can be a specific introduction of the intelligent cockpit domain controller (CDC) in the architecture 200.

[0134] like Figure 5As shown, architecture 500 includes: a trusted execution environment (TEE), an entertainment domain, a vehicle management domain, an instrument domain (RDA) and a trusted module.

[0135] TEE can be a secure computing environment that provides credibility and isolation for applications, which can run in a trusted environment, thus isolating from other applications and the operating system. TEE can include a communication encryption module, in which transport layer security (TLS) session keys and business keys can be stored.

[0136] The entertainment domain can provide entertainment functions and human-computer interaction functions, including: entertainment interaction application (application, APP), upper body control APP, system layer and operating system and driver.

[0137] The vehicle management domain can be used to support remote vehicle updates, fault diagnosis, vehicle health report generation, secure communications, operating system management, and certificate management.

[0138] The instrument cluster can provide the driver with key vehicle information, including speed, RPM, mileage, fuel status, warning lights, audio controls, etc., to improve driving safety and convenience.

[0139] The trusted module may include a vehicle control scenario verification module and an interrupt request (IRQ) processing module, which are used to verify the execution of vehicle control instructions and correctly process requests from various components or modules to ensure the stability and reliability of the CDC system.

[0140] Figure 6 It is a schematic flow chart of another verification method provided in an embodiment of the present application. Method 600 can be applied to architecture 500. Method 600 is a specific description of each step in method 400. Method 600 may include steps S601 to S607.

[0141] S601, the trusted module obtains an interrupt signal corresponding to a human-computer interaction event from an external device.

[0142] Specifically, when the user performs a touch screen operation, an interrupt signal may be sent to a trusted module of the security level (exception level, EL2). This step may correspond to ① in the architecture 500 , and the human-computer interaction event may be the first event in the method 400 .

[0143] Optionally, the external device may include: one or more of: physical buttons, display touch screen, DSP and Hi-Fi.

[0144] In a possible implementation, in a scenario where the external device includes a physical button, an interrupt signal will be sent to the CPU after the physical button is pressed. By configuring the trusted module control register (HCR), the interrupt signal is first sent to the trusted module corresponding to EL2, and then routed by the trusted module to the corresponding virtual machine, and the driver in the virtual machine parses the interrupt signal. In this process, the trusted module can update the time corresponding to the key interrupt in the cache after receiving the interrupt signal, and the above process can be transparent to the operating system and upper-layer applications in the virtual machine.

[0145] In a possible implementation, in a scenario where the external device includes a display touch screen, the display touch screen can send an interrupt signal to the CPU after being clicked by the user. Similar to the physical button scenario, the trusted module can refresh the latest touch screen time in the cache after receiving the interrupt signal, and then inject the interrupt signal into the virtual machine by writing the (Link Register, LR) register, and the driver in the virtual machine processes the interrupt signal. Among them, the LR register can be used to notify the CPU: the ID corresponding to the interrupt signal of the external device interaction, and injecting the interrupt signal into the virtual machine can be understood as: writing the ID of the interrupt signal into the LR register.

[0146] In a possible implementation, in a scenario where the external device includes a DSP or high-fidelity (HiFi), a keyword recognition algorithm can be deployed on the DSP for security and privacy reasons. When the DSP recognizes the keyword, it can instruct the CPU to obtain audio data in the audio buffer through an interrupt signal and perform further semantic analysis and interaction on the audio data. In this process, when the trusted module receives the interrupt signal, it can refresh the latest time of the voice interaction in the cache.

[0147] S602, the trusted module intercepts the human-computer interaction event and records the time in the cache.

[0148] Specifically, the trusted module may respond to the interrupt signal, record the interrupt type and the timestamp in the cache, and this step may correspond to ② in the architecture 500 , and the timestamp may correspond to the first moment in the method 400 .

[0149] S603, before issuing the vehicle control command, the vehicle control hardware abstraction layer (HAL) queries the vehicle control scene verification module whether the vehicle control command meets the legal triggering conditions.

[0150] Specifically, the above steps may correspond to ③ in architecture 500 , the vehicle control instruction may be the first control instruction in method 400 , and the vehicle control scene verification module may be the first module in method 400 .

[0151] Optionally, the vehicle control HAL may send a first request message to the vehicle control scene verification module to query the legality of the vehicle control instruction.

[0152] S604, the vehicle control scene verification module queries the cache. If the vehicle control instruction meets the legal trigger conditions, the vehicle control scene verification module can request TEE to sign the trigger conditions and timestamp.

[0153] Specifically, the above steps may correspond to step ④ in architecture 500.

[0154] Optionally, the trigger condition that the vehicle control instruction meets the legality can be understood as: the vehicle control instruction is legal, that is, the vehicle control scene verification module determines that the time between the moment when the human-computer interaction event occurs and the moment when the first control instruction is received is less than or equal to a first preset time.

[0155] Optionally, the signature of the legality trigger condition and the timestamp by the above-mentioned vehicle control scene verification module can be understood as: signing the time when the human-computer interaction event occurs and / or the human-computer interaction event.

[0156] In one embodiment, if the vehicle control scenario verification module determines that at least one valid scenario occurs within the first preset duration, it can be determined that the vehicle control instruction meets the legal triggering condition. The specific value of the first preset duration can be determined according to the time cost of the business. For example, the preset threshold can be set to 1 second. The above-mentioned valid scenarios can refer to scenarios such as physical buttons, touch screen interaction or voice interaction.

[0157] Optionally, for a vehicle control command that can be called in multiple scenarios, if one of the scenarios meets the legitimacy triggering condition, it can be determined that the vehicle control command meets the legitimacy triggering condition. For example, for the "open the car window" command, physical buttons, touch screen interaction or voice interaction can all be called, then if in the above three scenarios, the vehicle control scenario verification module determines that the time between the moment when any human-computer interaction event occurs and the moment when the first request information is received is less than or equal to the first preset time, then the "open the car window" command meets the legitimacy triggering condition.

[0158] Optionally, for vehicle control instructions that can only be called by specific scenarios, the duration between the time corresponding to the human-computer interaction event occurring in the specific scenario and the time when the first control instruction is received is less than or equal to the preset duration, and the vehicle control instruction can be judged to meet the legal triggering condition. For example, if the "automatic parking" instruction requires the user to click the touch screen to initiate, a touch screen event must occur, and the duration between the time when the touch screen event occurs and the time when the first control instruction is received is less than or equal to the preset duration, the vehicle control instruction can be determined to meet the legal triggering condition.

[0159] Alternatively, the vehicle control scenario verification module may also use a stored business key to sign the trigger condition and timestamp.

[0160] S605, the vehicle control scene verification module returns the signature to the vehicle control HAL.

[0161] Specifically, the above steps may correspond to step ⑤ in architecture 500.

[0162] S606, the vehicle control HAL sends the signature and the vehicle control command to the corresponding component via TLS.

[0163] Optionally, the corresponding component may be a VDC or an MDC, and the corresponding component may include the third module in method 400 .

[0164] Optionally, the vehicle control HAL may send the signature and the vehicle control command to a secure communication (SecCOM) module, which then sends them to corresponding components.

[0165] S607, after receiving the signature and the vehicle control instruction, the corresponding component can verify the integrity of the message and the signature.

[0166] Specifically, the corresponding component uses the key to decrypt the signature to obtain the time when the human-computer interaction time occurs. When the duration between the time when the human-computer interaction time occurs and the time when the vehicle control command is received is less than or equal to the second preset threshold, the corresponding component can execute the vehicle control command.

[0167] In the embodiment of the present application, the vehicle scene verification module can verify the legitimacy of the vehicle control command based on the time when the human-computer interaction event occurs and the time when the first request information is received, thereby preventing illegal vehicle control commands from being sent to corresponding components for execution, and improving the system safety of the vehicle. In addition, the corresponding component can obtain the time when the human-computer interaction event occurs based on the decryption of the signature result, and determine whether to execute the vehicle control command based on the time when the human-computer interaction event occurs and the time when the vehicle control command is received. In this way, the corresponding component can be further prevented from executing illegal control commands, thereby causing unnecessary losses to the user.

[0168] Figure 7 It is another system architecture applicable to the verification method provided in the embodiment of the present application. The system architecture 700 can be a specific introduction of the CDC in the architecture 200.

[0169] The difference between architecture 700 and architecture 500 is that the vehicle control service module (service, SA) and the vehicle control HAL can be migrated to a secure virtual machine, for example, the instrument domain. All vehicle control instructions can be issued by the secure virtual machine. The secure virtual machine includes an independent preset key, and other non-secure virtual machines cannot impersonate the secure virtual machine to send vehicle control instructions. The vehicle control service module determines whether the vehicle control instruction meets the legitimacy trigger condition. If so, the vehicle control instruction is allowed to be safely issued. Otherwise, the vehicle control instruction is not issued, and the malicious instruction is terminated in the CDC without the need for additional inspection of related components.

[0170] The functions of the various components in architecture 700 have been described in detail in architecture 500 and will not be repeated here.

[0171] Figure 8 It is a schematic flow chart of another verification method provided in an embodiment of the present application. Method 800 can be applied to architecture 700. Method 800 can be a specific description of each step in method 400. Method 800 can include steps S801 to S807.

[0172] S801, the trusted module obtains an interrupt signal corresponding to a human-computer interaction event from an external device.

[0173] Specifically, when the user performs a touch screen operation, an interrupt signal may be sent to a trusted module of the security level (exception level, EL2). This step may correspond to ① in the architecture 700, and the human-computer interaction event may be the first event in the method 400.

[0174] Optionally, the external device may include: one or more of: physical buttons, display touch screen, DSP and Hi-Fi.

[0175] In a possible implementation, in a scenario where the external device includes a physical button, an interrupt signal will be sent to the CPU after the physical button is pressed. By configuring the trusted module control register HCR, the interrupt signal is first sent to the trusted module corresponding to EL2, and then routed by the trusted module to the corresponding virtual machine, and the driver in the virtual machine parses the interrupt signal. In this process, the trusted module can update the time corresponding to the key interrupt in the cache after receiving the interrupt signal, and the above process can be transparent to the operating system and upper-layer applications in the virtual machine.

[0176] In a possible implementation, in a scenario where the external device includes a display touch screen, the display touch screen can send an interrupt signal to the CPU after being clicked by the user. Similar to the physical button scenario, the trusted module can refresh the latest touch screen time in the cache after receiving the interrupt signal, and then inject the interrupt signal into the virtual machine by writing the LR register, and the driver in the virtual machine processes the interrupt signal. Among them, the LR register can be used to notify the CPU: the ID corresponding to the interrupt signal for interaction with the external device, and injecting the interrupt signal into the virtual machine can be understood as: writing the ID of the interrupt signal into the LR register.

[0177] In a possible implementation, in a scenario where the external device includes a DSP or HiFi, a keyword recognition algorithm can be deployed on the DSP for security and privacy reasons. When the DSP recognizes the keyword, it can instruct the CPU to obtain audio data in the audio buffer through an interrupt signal and perform further semantic analysis and interaction on the audio data. In this process, when the trusted module receives the interrupt signal, it can refresh the latest time of the voice interaction in the cache.

[0178] S802, the trusted module intercepts the human-computer interaction event and records the timestamp in the vehicle control scene verification cache of the instrument domain.

[0179] Specifically, the trusted module can respond to the interrupt signal and record the interrupt type and timestamp in the cache of the instrument domain vehicle control verification module. This step can correspond to ② in architecture 700, and the timestamp can correspond to the first moment in method 400.

[0180] S803, the trusted module injects an interrupt signal into the operating system of the entertainment domain.

[0181] Specifically, this step may correspond to ③ in architecture 700.

[0182] S804, the upper body control APP in the entertainment domain sends the vehicle control instruction to the vehicle control SA in the instrument domain through the inter-domain secure communication mechanism.

[0183] Specifically, this step may correspond to ④ in architecture 700.

[0184] S805, the vehicle control SA calls the vehicle control scene verification module to query the cache to determine whether the vehicle control command meets the legal triggering conditions.

[0185] Specifically, this step may correspond to step ⑤ in architecture 700.

[0186] In one embodiment, the vehicle control SA may locally call the vehicle control scenario verification module to query and determine whether the vehicle control instruction meets the legality triggering condition.

[0187] In one embodiment, the vehicle control SA may send a first request message to the vehicle control scene verification module to request the vehicle control scene verification module to determine whether the vehicle control instruction satisfies the legitimacy trigger condition.

[0188] Optionally, the trigger condition that the vehicle control instruction meets the legality can be understood as: the vehicle control instruction is legal, that is, the vehicle control scene verification module determines that the time between the moment when the human-computer interaction event occurs and the moment when the first control instruction is received is less than or equal to a first preset time.

[0189] In one embodiment, if the vehicle control scenario verification module determines that at least one valid scenario occurs within the first preset duration, it can be determined that the vehicle control instruction meets the legal triggering condition. The specific value of the first preset duration can be determined according to the time cost of the business. For example, the preset threshold can be set to 1 second. The above-mentioned valid scenarios can refer to scenarios such as physical buttons, touch screen interaction or voice interaction.

[0190] Optionally, for a vehicle control command that can be called in multiple scenarios, if one of the scenarios meets the legitimacy triggering condition, it can be determined that the vehicle control command meets the legitimacy triggering condition. For example, for the "open the car window" command, physical buttons, touch screen interaction or voice interaction can all be called, then if in the above three scenarios, the vehicle control scenario verification module determines that the time between the moment when any human-computer interaction event occurs and the moment when the first request information is received is less than or equal to the first preset time, then the "open the car window" command meets the legitimacy triggering condition.

[0191] Optionally, for vehicle control instructions that can only be called by specific scenarios, the duration between the time corresponding to the human-computer interaction event occurring in the specific scenario and the time when the first control instruction is received is less than or equal to the first preset duration, and the vehicle control instruction can be judged to meet the legal triggering condition. For example, the "automatic parking" instruction requires the user to click the touch screen to initiate, so there must be a touch screen event, and the duration between the time corresponding to the touch screen event and the time when the first control instruction is received is less than or equal to the first preset duration, and the vehicle control instruction can be determined to meet the legal triggering condition.

[0192] S806: When the vehicle control instruction meets the legality triggering condition, the vehicle control SA may send the vehicle control instruction to the corresponding component.

[0193] Specifically, this step may correspond to ⑥ in architecture 700.

[0194] Optionally, the corresponding component may be a VDC or an MDC.

[0195] S807, after receiving the vehicle control command, the corresponding component can directly execute it.

[0196] In the embodiment of the present application, the vehicle scene verification module or the vehicle control SA can verify the legitimacy of the vehicle control command based on the time when the human-computer interaction event occurs and the time when the first request information is received, thereby preventing illegal vehicle control commands from being sent to the corresponding components for execution, and improving the system security of the vehicle. In addition, by migrating the vehicle control SA and the vehicle control HAL into the instrument domain, the vehicle control commands are all issued by the instrument domain. Since the instrument domain has its own independent key, other virtual machines cannot impersonate it to send vehicle control commands, which can further improve the security of the vehicle control commands.

[0197] Fig. 9 It is a schematic flowchart of a smart cockpit voice processing provided in an embodiment of the present application, which can be a specific description of the method of voice interaction input in method 400. Method 900 can include the following steps.

[0198] S901, a microphone (microphone, Mic) obtains the user's voice interaction information and sends the voice interaction information to the DSP for processing.

[0199] S902, after the DSP recognizes the wake-up keyword from the voice interaction information, it sends an interrupt signal to the system-on-a-chip (SoC).

[0200] Alternatively, the DSP may identify whether the voice interaction information includes a preset control instruction. When the DSP identifies that the voice interaction information includes a preset control instruction, the interrupt signal may be sent to the SoC for processing. The preset control instruction is used to generate a vehicle control instruction.

[0201] Alternatively, in step S902, if the DSP does not recognize the wake-up keyword from the voice interaction information, the voice interaction information can be discarded. At this time, the voice assistant can be in a dormant state and will not parse the voice interaction information of the user in the car, thereby protecting the user's privacy.

[0202] Optionally, the wake-up keyword can be understood as the name of the voice assistant contained in the user's voice interaction information.

[0203] S903, after receiving the interrupt signal, the SoC may wake up the HiVoice.

[0204] Among them, HiVoice can be a voice recognition and voice control platform for realizing voice interaction functions; HiVoice can recognize the user's voice interaction information and convert it into corresponding operation instructions.

[0205] S904, HiVoice recognizes the voice interaction information, and converts the voice interaction information into a vehicle control command and sends it to the vehicle control SA.

[0206] S905, the vehicle control SA performs a legality check on the vehicle control command. After the check passes, the vehicle control SA sends the vehicle control command to SecCOM.

[0207] Among them, the legitimacy check performed by the vehicle control SA on the vehicle control command can be the same as the legitimacy check steps of method 600 and method 800.

[0208] S906, secCOM forwards the vehicle control command to VIU.

[0209] S907, VIU converts the format of the vehicle control command and sends it to VDC.

[0210] S908: After receiving the vehicle control command, the VDC can directly execute it.

[0211] Optionally, in this step, after receiving the vehicle control command, the VDC may verify the integrity of the vehicle control command, and execute the vehicle control command if the verification passes.

[0212] In the embodiment of the present application, the user's intention to interact with the voice assistant can be determined by identifying the wake-up keywords in the voice interaction information sent by the user, and then the vehicle control command is generated based on the user's voice interaction information. In this way, the voice assistant is prevented from constantly parsing the user's voice interaction information, and the possibility of the voice analysis results being stolen by intruders is reduced, thereby improving the privacy security of the user.

[0213] Fig.10 This is a scenario in which the verification method provided in an embodiment of the present application is applicable, and method 900 can be applicable to this scenario.

[0214] like Fig.10As shown in (a) of FIG. 1 , the central control screen of the vehicle displays: a display interface 1000 and a function bar 1010. The display interface 1000 includes user account login information 1001 (the current vehicle has not logged in to the account), a Bluetooth function icon 1002, a Wi-Fi function icon 1003, a cellular network signal icon 1004, a car map application search box 1005, a card 1006 for switching to display all applications installed in the vehicle, a card 1007 for switching to display car music applications, a display card 1008 for the remaining battery power and remaining mileage of the vehicle, and a display card 1009 for the vehicle's 360-degree (°) surround view function. Among them, the car map application search box 1005 may include a user-set home control 10051 and a go to company control 10052. The function bar 1010 includes an icon 1011 for switching to display the central control large screen desktop, a vehicle internal circulation icon 1012, a driver's seat heating function icon 1013, a driver's area air-conditioning temperature display icon 1014, a passenger area air-conditioning temperature display icon 1015, a passenger seat heating function icon 1016 and a volume setting icon 1017.

[0215] like Fig.10 As shown in (b), the user issues a voice command "Please open the window" in the car. Since the DSP inside the vehicle does not recognize the wake-up keyword, the DSP will directly discard the voice data and the voice assistant will be in sleep mode.

[0216] like Fig.10 As shown in (c) in the figure, the user issues a voice command in the car, "Voice assistant, please open the window". Since the DSP inside the vehicle recognizes the wake-up keyword, it can perform subsequent audio processing and semantic analysis to generate a vehicle control command. After the vehicle executes the vehicle control command, the voice assistant 1019 and voice text 1018 can be displayed on the display interface 1000 to prompt the user that "your command has been received and the window has been opened."

[0217] In the embodiment of the present application, by identifying whether the voice interaction information sent by the user contains the wake-up keyword, it can be determined whether the user intends to interact with the voice assistant, thereby generating a vehicle control command for the user's voice interaction information. This method can prevent the voice assistant from continuously parsing the user's voice interaction information, thereby reducing the risk of the voice analysis results being stolen by intruders and improving the user's privacy security level.

[0218] It should be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0219] The embodiment of the present application also provides a device for implementing any of the above methods, and the device includes a unit for implementing each step performed by the vehicle 100 in any of the above methods.

[0220] Fig.11 1 is a schematic diagram of a verification device 1100 provided in an embodiment of the present application. The device 1100 may include an acquisition unit 1110, a transceiver unit 1120, and a processing unit 1130. The acquisition unit 1110 is used to acquire instructions and / or data, the transceiver unit 1120 is used to send and receive instructions and / or data, and the acquisition unit 1110 and the transceiver unit 1120 may also be referred to as a communication interface or a communication unit. The processing unit 1130 is used to perform data processing so that the device 1100 implements the aforementioned verification method.

[0221] Optionally, the device 1100 also includes a storage unit, which is used to implement a corresponding storage function and store corresponding instructions and / or data.

[0222] As a design, the device 1100 can execute the steps executed by the first module in the above embodiment.

[0223] The device 1100 includes: an acquisition unit 1110, used to acquire a first event; a transceiver unit 1120, used to receive a first request message sent by the second module, the first request message is used to request verification of the legality of a first control instruction, and the first control instruction is associated with a first input; a processing unit 1130, used to determine that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment is associated with a moment when the first event occurs, and the second moment is associated with a moment when the first request message is received; the transceiver unit 1120 is also used to send a first response message to the second module, and the first response message is used to indicate that the legality verification of the first control instruction has passed.

[0224] In a possible implementation, the processing unit 1130 is further configured to verify that the first request information is associated with the first event.

[0225] In a possible implementation, the first response information includes a signature result, and the signature result includes a signature for the first moment.

[0226] In a possible implementation, the first event includes: input of a physical key, input of a touch screen, or input of voice interaction.

[0227] In a possible implementation, the acquisition unit 1110 is specifically used to: detect a preset keyword, where the preset keyword includes: a wake-up word or a preset control instruction; and acquire a first event according to the preset keyword.

[0228] In a possible implementation, the processing unit 1130 is further configured to detect whether the voice interaction includes preset keywords based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

[0229] As a design, the device 1100 can execute the steps executed by the second module in the above embodiment.

[0230] Device 1100 includes: a processing unit 1130, used to generate a first control instruction, which is associated with a first input; a transceiver unit 1120, used to send the first control instruction to a third module if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0231] In one possible implementation, the transceiver unit 1120 is also used to: send a first request message to the first module, where the first request message is used to request verification of the legitimacy of the first control instruction; receive a first response message sent by the first module, where the first response message is used to indicate that the legitimacy verification of the first control instruction has passed, and the legitimacy verification of the first control instruction has passed is included in a first preset time period, and there is a first event.

[0232] In a possible implementation, the processing unit 1130 is further configured to query whether a first event occurs within a first preset time period.

[0233] In a possible implementation, the transceiver unit 1120 is further configured to send a signature result to the third module, where the signature result includes the signature at the first moment.

[0234] In a possible implementation, the transceiver unit 1120 is further configured to receive the signature result sent by the first module.

[0235] As a design, the device 1100 can execute the steps executed by the third module in the above embodiment.

[0236] The device 1100 includes: a transceiver unit 1120, used to receive a first control instruction sent by a second module; a processing unit 1130, used to execute the first control instruction if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with a first input.

[0237] In one possible implementation, the transceiver unit 1120 is also used to receive the signature result sent by the second module, the signature result includes a signature at a first moment, and the first moment is associated with the moment when the first event occurs; the processing unit 1130 is also used to determine that the duration between the first moment and the third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

[0238] In a possible implementation, the first event includes: input of a physical key, input of a touch screen, or input of voice interaction.

[0239] Optionally, if the device 1100 is located in the vehicle 100, the processing unit 1230 may be Figure 1 A processor 131 is shown.

[0240] Fig.12 is a schematic diagram of another verification device 1200 provided in an embodiment of the present application, and the device 1200 can be applied to Figure 1 In the vehicle 100.

[0241] The device 1200 includes: a memory 1210, a processor 1220, and a communication interface 1230. The memory 1210, the processor 1220, and the communication interface 1230 are connected through an internal connection path, the memory 1210 is used to store instructions, and the processor 1220 is used to execute the instructions stored in the memory 1210 to control the communication interface 1230 to obtain information, or to enable the device 1200 to implement the aforementioned verification method. Optionally, the memory 1210 can be coupled to the processor 1220 through an interface, or can be integrated with the processor 1220.

[0242] It should be noted that the communication interface 1230 uses a transceiver device such as, but not limited to, a transceiver. The communication interface 1230 may also include an input / output interface.

[0243] The processor 1220 stores one or more computer programs, and the one or more computer programs include instructions. When the instructions are executed by the processor 1220, the verification device 1200 executes the verification method in each of the above embodiments.

[0244] In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 1220 or an instruction in the form of software. The method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in the processor for execution. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1210, and the processor 1220 reads the information in the memory 1210 and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0245] Optionally, Fig.12 The communication interface 1230 in the embodiment can be implemented Fig.11 The acquisition unit 1110 or the transceiver unit 1120, Fig.12 The processor 1220 in the embodiment can implement Fig.11 The processing unit 1130 in.

[0246] Optionally, the device 1100 or the device 1200 may be a computing platform, and the computing platform may be a vehicle-mounted computing platform.

[0247] Optionally, the device 1100 or the device 1200 may be located at Figure 1 In the vehicle 100.

[0248] Optionally, the device 1100 or the device 1200 may be Figure 1 A computing platform 130 in a vehicle.

[0249] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program code, and when the computer program code is executed on a computer, the computer executes the above Figures 4 to 9 Any of the methods in .

[0250] The present application also provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes the above Figures 4 to 9 Any method.

[0251] The present application also provides a chip, including: a circuit, the circuit is used to execute the above Figures 4 to 9 Any of the methods in .

[0252] The present application also provides a vehicle, comprising: Fig.11 or Fig.12 Any authentication device.

[0253] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0254] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0255] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0256] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0257] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0258] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0259] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A verification method, characterized in that: The method is applied in a first module, and the method comprises: Get the first event; receiving first request information sent by the second module, where the first request information is used to request verification of the legitimacy of a first control instruction, where the first control instruction is associated with a first input; Determine that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment is associated with a moment when the first event occurs, and the second moment is associated with a moment when the first request information is received; A first response message is sent to the second module, where the first response message is used to indicate that the legitimacy verification of the first control instruction has passed.

2. The method according to claim 1, characterized in that Before determining that the duration between the first moment and the second moment is less than or equal to the first preset duration, the method further includes: Verify that the first request information is associated with the first event.

3. The method according to claim 1 or 2, characterized in that The first response information includes a signature result, and the signature result includes a signature for the first moment.

4. The method according to any one of claims 1 to 3, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

5. The method according to claim 4, characterized in that The first event includes the input of the voice interaction, and the obtaining of the first event includes: Detecting a preset keyword, wherein the preset keyword includes: a wake-up word or a preset control instruction; The first event is obtained according to the preset keyword.

6. The method according to claim 5, characterized in that Before detecting the preset keyword, the method further includes: The digital signal processor DSP or the high-fidelity Hi-Fi chip is used to detect whether the voice interaction includes the preset keyword.

7. A verification method, characterized in that: The method is applied in the second module, and the method comprises: generating a first control instruction, wherein the first control instruction is associated with a first input; If a first event occurs within a first preset duration, the first control instruction is sent to a third module, wherein the first preset duration is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

8. The method according to claim 7, characterized in that Before sending the first control instruction to the third module, the method further includes: Sending first request information to the first module, where the first request information is used to request verification of the legitimacy of the first control instruction; Receive first response information sent by the first module, where the first response information is used to indicate that the legitimacy verification of the first control instruction has passed, that the legitimacy verification of the first control instruction has passed is included within the first preset time period, and that the first event exists.

9. The method according to claim 7, characterized in that Before sending the first control instruction to the third module, the method further includes: Query whether the first event exists within the first preset time period.

10. The method according to any one of claims 7 to 9, characterized in that: The method further comprises: Sending a signature result to the third module, where the signature result includes a signature for the first moment.

11. The method according to claim 10, characterized in that Before sending the signature result to the third module, the method further includes: Receive the signature result sent by the first module.

12. A verification method, characterized in that: The method is applied in the third module, and the method comprises: receiving a first control instruction sent by the second module; If a first event occurs within a first preset duration, the first control instruction is executed, wherein the first preset duration is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

13. The method according to claim 12, characterized in that Before executing the first control instruction, the method further includes: receiving a signature result sent by the second module, wherein the signature result includes a signature for the first moment; Determine that the duration between the first moment and a third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

14. The method according to claim 13, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

15. A verification device, characterized in that: The device comprises: An acquiring unit, used for acquiring a first event; A transceiver unit, configured to receive first request information sent by the second module, wherein the first request information is used to request verification of the legitimacy of a first control instruction, wherein the first control instruction is associated with a first input; A processing unit, configured to determine that a duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment being associated with a moment when the first event occurs, and the second moment being associated with a moment when the first request information is received; The transceiver unit is further used to send first response information to the second module, where the first response information is used to indicate that the legitimacy verification of the first control instruction has passed.

16. The device according to claim 15, characterized in that The processing unit is further configured to verify that the first request information is associated with the first event.

17. The device according to claim 15 or 16, characterized in that The first response information includes a signature result, and the signature result includes a signature for the first moment.

18. The device according to any one of claims 15 to 17, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

19. The device according to claim 18, characterized in that The first event includes the input of the voice interaction; The acquisition unit is specifically used for: Detecting a preset keyword, wherein the preset keyword includes: a wake-up word or a preset control instruction; The first event is obtained according to the preset keyword.

20. The device according to claim 19, characterized in that The processing unit is further used to detect whether the voice interaction includes the preset keyword based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

21. A verification device, characterized in that: The device comprises: a processing unit, configured to generate a first control instruction, wherein the first control instruction is associated with a first input; A transceiver unit is used to send the first control instruction to a third module if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

22. The device according to claim 21, characterized in that The transceiver unit is further used for: Sending first request information to the first module, where the first request information is used to request verification of the legitimacy of the first control instruction; Receive first response information sent by the first module, where the first response information is used to indicate that the legitimacy verification of the first control instruction has passed, that the legitimacy verification of the first control instruction has passed is included within the first preset time period, and that the first event exists.

23. The device according to claim 21, characterized in that The processing unit is further used to query whether the first event exists within the first preset time period.

24. The device according to any one of claims 21 to 23, characterized in that The transceiver unit is further used to send a signature result to the third module, where the signature result includes a signature for the first moment.

25. The device according to claim 24, characterized in that The transceiver unit is further used to receive the signature result sent by the first module.

26. A verification device, characterized in that: The device comprises: A transceiver unit, configured to receive a first control instruction sent by the second module; A processing unit, used for executing the first control instruction if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

27. The device according to claim 26, characterized in that The transceiver unit is further configured to receive a signature result sent by the second module, wherein the signature result includes a signature for the first moment; The processing unit is further used to determine that the duration between the first moment and a third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

28. The device according to claim 27, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

29. A verification device, characterized in that: include: A processor and a memory, wherein the processor is coupled to the memory and is configured to read and execute instructions in the memory to perform the method according to any one of claims 1 to 6.

30. The device according to claim 29, characterized in that The apparatus is a device having a trusted execution environment.

31. A verification device, characterized in that: include: A processor and a memory, wherein the processor is coupled to the memory and is configured to read and execute instructions in the memory to perform the method according to any one of claims 7 to 11.

32. A verification device, characterized in that: include: A processor and a memory, wherein the processor is coupled to the memory and is configured to read and execute instructions in the memory to perform the method according to any one of claims 12 to 14.

33. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program code, and when the computer program code is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 14.

34. A chip, characterized in that: include: A circuit for executing the method according to any one of claims 1 to 14.

35. A vehicle, characterized in that: include: A device as claimed in any one of claims 15 to 32.

Images